Run shellcheck strict

[firecow]

The shellcheck job only failed on default-severity findings, so it now runs with every optional check enabled at style severity and the entrypoint script is adjusted to pass.

---

Summary by cubic

Runs ShellCheck with every optional check at style severity and fixes the script issues it flags.

• Sets SHELLCHECK_OPTS to --enable=all and severity to style in the QA workflow.
• Hardens variable expansions in firecow_cloudflared with a default for TUNNEL_LOGLEVEL and quoted expansions.

^{Written for commit 28d4c98. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}